;'/%3e%3cpath%20d='M650.96,446.444L650.96,292.942L772.949,292.942L772.949,325.3L686.314,325.3L686.314,352.619L763.662,352.619L763.662,383.483L686.167,383.483L686.167,412.972L773.843,412.972L773.843,446.444L650.96,446.444'%20style='fill:rgb(253,104,77);'/%3e%3cpath%20d='M834.707,446.441L834.707,292.942L869.122,292.942L944,391.925L942.71,292.942L977.896,292.942L977.896,446.444L945.981,446.444L868.999,348.007L868.998,446.444L834.707,446.441Z'%20style='fill:rgb(253,104,77);'/%3e%3cpath%20d='M1079.22,446.444L1114.519,446.444L1114.292,325.165L1162.011,325.165L1162.239,289.386L1033.314,289.386L1033.086,325.971L1078.793,325.971L1079.021,446.441'%20style='fill:rgb(253,104,77);'/%3e%3cg%20transform='matrix(-1,0,0,1,2162.902918,0.002879)'%3e%3cpath%20d='M211.655,446.441L250.89,446.441L307.26,335.266L331.9,381.995L303.85,381.994L290.601,407.994L344.902,407.993L363.603,446.441L401.27,446.441L323.001,292.939L291.997,292.954L211.655,446.441'%20style='fill:rgb(253,104,77);'/%3e%3c/g%3e%3cg%20transform='matrix(1,0,0,1,0.393328,0.512948)'%3e%3cpath%20d='M211.655,446.441L250.89,446.441L307.26,335.266L331.9,381.995L303.85,381.994L290.601,407.994L344.902,407.993L363.603,446.441L401.27,446.441L323.001,292.939L291.997,292.954L211.655,446.441'%20style='fill:rgb(253,104,77);'/%3e%3c/g%3e%3cpath%20d='M1217.201,446.444L1337.397,446.444L1337.397,413.487L1252.16,413.487L1252.16,290.404L1217.201,290.404L1217.201,446.444Z'%20style='fill:rgb(253,104,77);'/%3e%3cpath%20d='M1598.104,446.444L1633.284,446.444L1633.284,396.702L1648.836,381.15L1700.231,446.444L1741.13,446.444L1673.16,358.757L1741.663,291.212L1694.8,291.305L1633.43,352.954L1633.43,290.404L1598.311,290.404L1598.104,446.444Z'%20style='fill:rgb(253,104,77);'/%3e%3cpath%20d='M1455.819,290.407C1501.774,290.407%201539.083,326.162%201539.083,370.203C1539.083,414.244%201501.774,450%201455.819,450C1409.864,450%201372.554,414.244%201372.554,370.203C1372.554,326.162%201409.864,290.407%201455.819,290.407ZM1455.819,322.631C1428.423,322.631%201406.182,343.946%201406.182,370.2C1406.182,396.455%201428.423,417.77%201455.819,417.77C1483.214,417.77%201505.456,396.455%201505.456,370.2C1505.456,343.946%201483.214,322.631%201455.819,322.631Z'%20style='fill:rgb(253,104,77);'/%3e%3c/g%3e%3c/svg%3e)
Security is the product. Not the disclaimer.
The agents you hire on AgentLoka touch your real systems: email, billing, CRM, code. Every layer of the platform is built so that's defensible by default and explainable when it isn't.
Eight pillars,
Data handling
Every byte is encrypted, isolated, and accounted for.
- Encryption at rest: AES-256 (AWS KMS, customer-managed keys on Business tier).
- Encryption in transit: TLS 1.3 enforced end-to-end. HSTS preload submitted.
- Per-workspace credential isolation: OAuth tokens never cross tenants.
- Object storage with server-side encryption and bucket-level access policies.
- Backups encrypted, cross-region, RPO 5 min / RTO 1 h.
Authentication
Strong by default, frictionless when it can be.
- Email + password with bcrypt (cost 12) and breached-password checks.
- Magic link and one-time codes (OTP) for low-friction sign-in.
- WebAuthn / passkeys supported for any account.
- 2FA: TOTP and WebAuthn, enforceable workspace-wide.
- SAML SSO (Okta, Azure AD, Google Workspace, Auth0) on Business tier.
- SCIM provisioning + deprovisioning for Business tier.
Multi-tenant isolation
Workspace boundary enforced at every layer.
- Every API request is scoped to a workspace; cross-workspace reads are impossible by construction.
- Database rows tagged with workspace_id; row-level security in Postgres enforces the boundary.
- Per-workspace queues and worker pools prevent noisy-neighbour blast radius.
- Per-workspace integration credentials, encrypted with a unique data-key per tenant.
Audit log
Append-only. Tamper-evident. Yours.
- Every prompt, tool call, output, and admin action recorded.
- Append-only storage; each entry signed and chained to the prior hash.
- Retention: 7 days (Free), 30 days (Pro), 7 years (Business).
- Export to S3 / GCS / Azure Blob on Business tier.
- SIEM streaming (Splunk, Datadog, Sumo) via signed webhooks.
Data residency
Pin workspaces to a region. Stay there.
- US-east (N. Virginia), US-west (Oregon), EU-Frankfurt, AP-Mumbai.
- Region pin is workspace-level and one-way per workspace.
- EU and India workspaces never leave their region for inference, storage, or logs.
- Cross-region failover within the chosen region's geography only.
Vulnerability program
Report it. We'll work it. We'll credit you.
- Responsible disclosure inbox: security@agentloka.com.
- Triage in 1 business day; severity-1 fix in 7 days.
- Public hall of fame for valid reports (opt-in).
- Pen tests every 12 months; SOC 2 attestation in progress with a Big-4 auditor.
- Quarterly third-party reviews of the LLM tool-call safety rails.
Self-host option
Run the whole platform in your own VPC.
- Helm chart for Kubernetes, docker-compose for development.
- BYO Postgres, S3-compatible object storage, and LLM provider keys.
- Air-gapped install with offline model providers (Bedrock, on-prem inference).
- Same code as the SaaS, including audit log, builder, and marketplace mirror.
- Available on Business tier; talk to sales@agentloka.com.
LLM safety rails
Prompt-injection defense at the runtime, not in the prompt.
- Schema validation on every tool call before it reaches an integration.
- Scope checks: SQL writes, path traversal, private-IP webhooks, oversized recipient lists are blocked.
- Per-agent and per-hire spend caps halt execution before damage.
- Prompt and response retention configurable; zero-retention provider routes available on Business.
- Hard 50-iteration cap and 24-hour wall-clock cap on every run.
Who we share data with, and why.
The list is short on purpose. Every entry has a DPA in place; every workspace can pin its region.
| Subprocessor | Purpose | Region | DPA |
|---|---|---|---|
| Amazon Web Services | Compute, storage, KMS, network | US, EU, AP (per workspace pin) | Yes |
| Stripe | Billing, payouts (Stripe Connect) | US (Stripe-hosted) | Yes |
| Resend | Transactional email | US | Yes |
| Sentry | Application error tracking | US (EU available) | Yes |
| PostHog | Product analytics (cookie-less, IP-truncated) | EU | Yes |
| Integration gateway | OAuth + API token brokerage for 800+ third-party tools | US, EU (per workspace pin) | Yes |
| Cloudflare | DNS, WAF, DDoS mitigation, asset CDN | Global edge | Yes |
| LLM providers | Model inference (selectable per agent; zero-retention contracts where supported) | US, EU (provider-dependent) | Yes |
The integration gateway is a white-labeled vendor that brokers OAuth for 800+ third-party APIs on our behalf. We keep its identity unsurfaced by policy, but we treat it as a subprocessor with the standard DPA. Customers under NDA can request the vendor name from legal@agentloka.com.
Found something?
We triage every security report within one business day. Critical issues get a fix or mitigation within seven days. Valid reports go into our hall of fame (opt-in). Please don't run any test that would affect another customer's data; if you need a clean sandbox, email and we'll spin one up.